978
OAuth (piefed.europe.pub)
submitted 1 year ago by to c/programmer_humor@programming.dev
82 comments fedilink hide all child comments
 
OAuth
you are viewing a single comment's thread
view the rest of the comments
[–] 18 points 1 year ago (8 children)

a very long password that (ideally) is only bound to a single device, requires a second identifier (biometric, PIN, password) and that is phishing resistant.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [+] 19 points 1 year ago* (last edited 1 year ago) (6 children)
    [deleted]
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 19 points 1 year ago

    Bitwarden has been working great with me as sits transition to passkeys, even big corporate ones.

    But yeah in practice, google and facebook are going to probably dominate because they are the easy + free option.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 13 points 1 year ago (2 children)

    KeepassXC supports passkeys as well.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 5 points 1 year ago* (1 child)

    thus rendering them redundant, because their strength is being bound to a single physical device. if they're portable, they're as good as asymmetric key pairs.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 8 points 1 year ago

    Their strength is being half a cryptographic key, not that they’re device bound.

    That was a “requirement” that big tech wanted, to force you to be dependent on TPM storage, so you’d be forced to use a Trusted(tm) device and OS. It was made optional after pushback from basically everyone else.

    Password managers support Passkeys now. Bitwarden and KeePassX among others.

    As long as I trust that my password manager is secure, and as long as I use a strong master password or (better) have a hardware key to unlock it, it is way more secure than a password, and I can still install Linux without losing my logins.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 1 year ago (1 child)

    that's not the point, passkeys are not vendor centric, they are a standard. you don't want to duplicate a passkey for the same reason you don't want to copy an SSH private key on multiple devices. it's a security feature that allows disabling the account access in case the device becomes compromised (lost, stolen, infected, etc.)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    • load more comments (-1 replies)
  • [–] 3 points 1 year ago (1 child)

    i refuse to give my phone my thumbprint or do a face unlock. i'm not sure if it's still collecting a biometric bullshit on my face, but i have not done it myself. I'm a luddite here and i insist on it so no one (especially no one trying to violate the united states 4th amendment) can get into my phone without my permission or hacking into it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 1 year ago* (last edited 1 year ago)

    i refuse to give my phone my thumbprint or do a face unlock. i'm not sure if it's still collecting a biometric bullshit on my face, but i have not done it myself.

    Then get a Yubikey. Replace “something you are” with “something you have”. It’s not ideal to have two somethings you have as your two factors, but a password to get into the computer to get to the passkey adds an extra layer that makes me comfortable with it.

    I'm a luddite here and i insist on it so no one (especially no one trying to violate the united states 4th amendment) can get into my phone without my permission or hacking into it.

    In the context of this discussion, it’s one of two factors. But I agree with you when it’s the only factor.

  • permalink
  • fedilink
  • source
  • parent
    • load more comments (-1 replies)